KranzKrone

default

Privacy policy

Complete before public launch: operator name, full postal address, email address, hosting provider, hosting location and concrete retention periods. The placeholders in this prepared policy must not remain on a public website.

Last updated: 27 July 2026

1. Controller

The controller responsible for processing personal data on this website is:

  • [Full name]
  • [Street and number]
  • [Postcode and city]
  • [Country]
  • Email: [Email address]

Full provider details are available in the Legal notice. A contact option is available under Contact.

2. Hosting and server logs

This website is hosted by [name and address of hosting provider] on servers located in [country/region].

When a page is requested, the web server may process technically required log data. This can include the IP address, date and time, requested address, amount of data transferred, referrer, browser identifier, operating system and status code. Processing serves secure and stable operation, error analysis and protection against misuse.

The legal basis and actual retention period must be checked against the final hosting agreement and added before publication: [add legal basis and deletion period].

3. External resources and fonts

The theme does not load fonts, scripts, stylesheets, images or tracking pixels from Google or other external third parties. Typography primarily uses system fonts already available on the visitor's device or browser. When the optional “Playful (Comic Neue)” choice is active, two bundled font files are loaded exclusively from the site's own server; no connection to Google Fonts, GitHub or another font provider is made.

Local symbols, placeholders and theme files are served by this website. External websites are contacted only when a clearly marked link is deliberately opened.

4. Cookies and local display preferences

According to the current technical review, anonymous visits to the public website do not set a cookie. No analytics, advertising or tracking cookies are used.

The protected Kirby administration area uses a technically required session cookie named kirby_session. It is used exclusively for authentication, session management and Panel security. A public page view does not require this Panel cookie.

After an explicit selection, the theme stores the following functional display preferences in the browser's local storage:

  • theme: selected light or dark mode
  • color-scheme: explicitly selected colour preset; “Website default” removes this local override
  • pattern: explicitly selected background pattern; “Website default” removes this local override
  • column-layout:articles: selected blog grid width
  • column-layout:status: selected microblog grid width
  • column-layout:audiobooks: selected audiobook grid width
  • column-layout:photography: selected photography grid width
  • column-layout:games: selected game grid width
  • column-layout:blogroll: selected blogroll grid width

These values contain no user identifier and are not transmitted to the server or any third party. They remain until another option is selected or the website data is deleted in the browser. Without storage, the system colour preference and server-rendered defaults apply.

As the current site stores only explicitly selected functional preferences and uses no tracking requiring consent, no cookie consent banner is displayed. This assessment must be repeated before any analytics, embed or third-party feature is introduced.

5. Comments

Comments can be enabled for individual articles, short posts or photos. When a comment is submitted, the website processes:

  • comment text
  • name
  • email address
  • optional website
  • assignment to the commented page
  • technical transmission and moderation data

The name, comment and an optional website may be displayed publicly after approval. The email address is technically received and validated on submission, but the current plugin configuration does not store it in plain text or publish it with the comment. The comment plugin derives a non-reversible MD5 value from it as part of an avatar address and stores that value with the comment. As this derived value can still make a person indirectly recognisable, it is protected and deleted together with the remaining comment data.

The public page does not load that avatar address or an image from Gravatar or any other avatar provider. Instead, the server creates a local SVG from the initials of the submitted name. External avatar addresses received with webmentions are not embedded in the visitor's browser either.

By submitting the form, the commenter consents to storage and display of the comment. The legal basis is Article 6(1)(a) GDPR. Consent can be withdrawn for the future using the contact details above. Processing performed before withdrawal remains lawful.

Comments are stored as files on the web server. Pending, rejected and published comments are deleted after [add concrete moderation and deletion period], unless legal obligations or legitimate reasons require longer storage.

6. Webmentions

The website can receive notifications that another website links to a post. This may process the source URL, target URL, excerpt, author information, publication date and other metadata supplied by the linking website.

Incoming webmentions are not published automatically and require moderation. The legal basis, retention period and handling of disputed entries must be decided before public operation: [add details].

7. Newsletter

The newsletter area is technically prepared but remains disabled without a configured form endpoint. In this state, no email address is transmitted.

Before activation, this policy must name the provider, recipients, purposes, legal basis, double opt-in procedure, retention, withdrawal, processing agreement and any international transfer. On submission, the email address would be sent to the provider explicitly named here.

8. Mastodon and external profiles

Automatic Mastodon publishing concerns only new microblog posts published by the operator and is active only after server-side configuration. Normal page views do not embed or load a Mastodon resource.

Profile, feed, blogroll and other external links contact third-party services only after a deliberate click. The privacy terms of the respective provider apply from that point.

9. Data subject rights

Where the legal requirements are met, data subjects may have rights of access, rectification, erasure, restriction, portability and objection. Consent can be withdrawn at any time for the future.

Requests can be sent to the address in section 1. Data subjects may also lodge a complaint with a competent data protection authority.

10. Updates

This policy must be updated before new analytics, advertising, embedded content, newsletter, commenting, login or third-party functionality is activated. Changes to hosting, plugins, cookies or browser storage also require a new review.